CVE-2026-6610
Low · 3.7CVSS
3.7
EPSS
0.4%
Published
Apr 20, 2026
CISA due date
—
The record
A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file djangoblog/settings.py of the component Setting Handler. Such manipulation of the argument USER/PASSWORD leads to hard-coded credentials. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-86673 A vulnerability was determined in ningzichun Student Management System up to… CWE-259
- CVE-2026-86276 A flaw has been found in SourceCodester Syllabus-Aligned Learning Management &… CWE-259
- CVE-2026-86150 A security vulnerability has been detected in Tenda CP3 27.5.57.101. CWE-259
- CVE-2026-70403 XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). CWE-259
- CVE-2026-82808 A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on… CWE-259
- CVE-2026-19901 A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. CWE-259
- CVE-2026-19900 A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. CWE-259
- CVE-2026-19750 A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. CWE-259